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Abstract 

Intelligent Control and Health Management technology for aircraft propulsion systems is much more developed in 
the laboratory than in practice. With a renewed emphasis on reducing engine life cycle costs, improving fuel 
efficiency, increasing durability and life, etc., driven by various government programs, there is a strong push to 
move these technologies out of the laboratory and onto the engine. This paper describes the existing state of engine 
control and on-board health management, and surveys some specific technologies under development that will 
enable an aircraft propulsion system to operate in an intelligent way — defined as self-diagnostic, self-prognostic, 
self-optimizing, and mission adaptable. These technologies offer the potential for creating extremely safe, highly 
reliable systems. The technologies will help to enable a level of performance that far exceeds that of today’s 
propulsion systems in terms of reduction of harmful emissions, maximization of fuel efficiency, and minimization of 
noise, while improving system affordability and safety. Technologies that are discussed include various aspects of 
propulsion control, diagnostics, prognostics, and their integration. The paper focuses on the improvements that can 
be achieved through innovative software and algorithms. It concentrates on those areas that do not require 
significant advances in sensors and actuators to make them achievable, while acknowledging the additional benefit 
that can be realized when those technologies become available. The paper also discusses issues associated with the 
introduction of some of the technologies. 


Introduction 


The intent of this paper is to describe selected algorithms that enable the development of an intelligent control for 
aircraft engines. Specifically, it focuses on the areas where improved performance and lower life cycle cost can be 
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achieved through on-board software. These include promising control, diagnostics and prognostics algorithms, as 
well as their integration into a coordinated system. There is some discussion of adding sensors for diagnostics, as 
well as the prevailing attitude concerning that. However, it is recognized that sensor technology will advance, and 
the impact of that fact must not be discounted. Still, the paper stays away from discussing technologies that rely on 
the development of new sensors, and addresses areas where current sensors (or current types of sensors at current 
locations) suffice for the algorithms to provide benefit. 

The paper is organized as follows. The rest of this section provides some basic background on turbofan engines, 
along with a brief overview of the current control structure and on-board monitoring systems — this may help the 
reader to understand the applications presented later. This leads into a working definition of Intelligent Control for 
turbine engines. The next section covers some approaches to intelligent control of jet engines. Following this is a 
section on diagnostics, which describes various systems and approaches, including a discussion of diagnostic 
sensors. This is followed by sections on prognostics and integration, and finally concluding remarks. 

Engine Overview 

A turbofan engine gas path consists of several components arranged from front to back of an engine (fig. 1). The 
first component is the fan which is open to the outside and in a commercial engine provides most of the thrust by 
sending a vast quantity of air around the engine core, bypassing the other components (turbomachinery). The first of 
these remaining components is the booster, also known as the low pressure compressor (LPC), which is followed by 
the high pressure compressor (HPC). This opens into the combustor where fuel is injected and burned. The resulting 
hot gas drives the high pressure turbine (HPT) and the low pressure turbine (LPT). Each of these components affects 
the engine’s operation, and algorithms for improved control and knowledge about component health will enable a 
higher level of performance to be obtained. The state of component health involves characteristics that degrade over 
time: such features as efficiency, flow capacity, and seal leakage. These tend to change slowly over many flights, 
but abrupt changes might indicate the occurrence of a sudden fault. 

From a structural point of view, the engine is made up of rotating and non-rotating parts. The non-rotating outer 
portion consists of, among other things, the ducts for bypass airflow, and stator vanes which project into the airflow 
through the components. It also contains the bearings outer races that hold the rolling elements that support the 
shafts. The shafts in turn support the fan, compressor, and turbine disks — these are the rotating components. The low 
pressure shaft supports the fan, LPC, and LPT. The hollow high pressure shaft fits around the low pressure shaft and 
is separated from it by bearings; it supports the HPC and HPT. The compressors and turbines each consist of 
multiple disks attached to the shaft, and each disk is fitted with multiple blades around its circumference. As these 
parts rotate, they interact, setting up natural vibrations and resonances. Shifts in an engine vibration signature may 
signal damage. 
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Figure 1. — Commercial turbofan engine cross section showing components. 


NASA/TM— 2005-2 13622 


2 




Figure 2. — Block diagram of typical engine control law architecture. 


Control 

Typical aircraft engine control systems maintain fan speed or engine pressure ratio to regulate thrust, which is not 
directly measurable. The controllers are generally based on a variant of a Proportional-Integral (PI) scheme, 
combined with limit logic (fig. 2). This limit logic consists of a series of min select and max select blocks, each of 
which selects a fuel flow rate command based on various physical limits, acceleration/deceleration schedules 
(maximum rotor speed rate-of-change as a function of rotor speed), and the current operating state (speed governor 
loops). The final command that exits the selection logic block is integrated to produce a new total fuel flow. Thus an 
increment of zero will result in no change in fuel flow, and a constant steady fuel flow will occur when steady state 
error is eliminated. 


Diagnostics 

The various on-wing health monitoring systems of today, which are a collection of separate, unrelated 
technologies, provide a basic level of monitoring. Their capabilities are relatively limited and the information they 
provide is used mostly to initiate maintenance actions, not for real-time decision-making. 

One instance where the information is used on wing is for sensor validation. The controller has some simple logic 
to perform basic limit or rate of change checks on engine sensors and actuators. In some cases, on-board engine 
models are used in conjunction with the controller’s own sensor voting scheme to help determine which sensor is 
correct when redundant sensors disagree. The controller has the additional responsibility of checking whether a 
speed red-line has been exceeded, and reducing fuel flow when it has. 

Current engine vibration monitoring systems sample at a relatively low frequency — too low to capture much 
significant or useful information on the vibratory modes of the system. They check the vibration magnitude to 
determine that it is within a normal range. Magnitudes that are too high might indicate a bearing failure or engine 
imbalance, magnitudes that are too low might indicate a faulty sensor or seized engine. 

Lubrication system monitoring is performed using a magnetic chip detector to determine the existence of ferrous 
debris in oil. This is an indication of part wear. 

Life cycle counts are performed on-wing. Engine parts, especially those in the hot section, may experience a 
maximum number of severe thermal transients before they must be retired. Each time the engine goes through a 
start-up transient, the life cycle count for each of the critical components is incremented. This way, part life is 
tracked as a function of use to facilitate scheduled maintenance. 

Intelligent Control 

While these traditional control and diagnostic techniques are time-tested and reliable, modern control techniques 
promise to provide improved control and therefore improved aircraft propulsion system performance. There is little 
on-board today that could be considered “intelligent.” Even with all of the advances in modeling and algorithms, 
implemented control and health management schemes still maintain safety margins in terms of worst-case stack up 
of uncertainties; they still consider life usage in terms of idealized flight cycles; and there is essentially no 
accommodation beyond simple predetermined responses to specific detected faults. The engines of today are reliable 
and safe, but they are expensive to operate and maintain. With the integration of available models and algorithms for 
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Figure 3. — An example of an intelligent control framework for the SSME. 


on-board operation and the resultant increase in on-board intelligence, engines of the future will be able to operate 
even more safely and reliably with reduced life cycle cost. 

The concept of an intelligent control system that is self-aware and modifies itself in response to changes in itself 
or its environment is well established. 1,2 The vision of an intelligent engine control that combined control and health 
management was first conceived for reusable rocket engines, in particular the space shuttle main engine (SSME). 3 
The impetus for this was that the SSME was not as durable as had been expected and that it might benefit from the 
experience gained in the air breathing arena. Control complexity for air breathing engines had increased over the 
years, to the point where it had surpassed that of the SSME, yet the SSME was a more complex machine operating 
in a significantly harsher environment; thus there was a clear justification to increase its level of “intelligence.” The 
framework proposed in reference 3 for the intelligent control consisted of “a hierarchy of various control and 
diagnostic functionalities. These functionalities include life-extending control, adaptive control, real-time engine 
diagnostics and prognostics, component condition monitoring, real-time identification, and sensor/actuator fault 
tolerance. Artificial intelligence techniques [would] be considered for implementing coordination, diagnostics, 
prognostics, and reconfiguration functionalities.” An example of an intelligent control framework for the SSME that 
was demonstrated in simulation is shown in figure 3 (ref. 4). Conceptually, both the above description and the figure 
could apply equally well to an intelligent control system for an air breathing engine. The goal of such an intelligent 
system is to increase the level of autonomy of the engine enough that it becomes self-diagnostic, self-prognostic, 
self-optimizing, and mission adaptable. This means that it can diagnose and recover from faults, it can anticipate and 
avoid or at least minimize the impact of faults, and it can alter either its performance or its goals to increase the 
likelihood of successfully completing the overall mission even with degraded capability. 

The current idea of intelligent control and health management of jet engines is essentially the same as the original 
concept for the SSME; the functionality of the framework is just as valid today as it was then. In general terms, the 
intelligent control framework consists of a hierarchical structure: the lower levels operate on a shorter time scale 
performing duties that are algorithmic in nature requiring less intelligence, while the upper levels operate on a 
longer time scale utilizing broad intelligence. 5 In the engine application, viewed in the larger context of the vehicle, 
the lowest level performs direct control, with the basic diagnostic functions above that. The results of the diagnostic 
system are fed to an Engine Level Coordinator which evaluates the engine’s ability to carry out its mission. 6 In a 
multi-engine vehicle, the Engine Level Coordinator communicates with a Propulsion Level Control responsible for 
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distributing the propulsion tasks among the various engines. 7 The Propulsion Level Control in turn communicates 
with a Mission Level Control that evaluates the feasibility of attempting to complete the mission given the condition 
of the engines and vehicle, and perhaps replans the mission to increase the probability of success. 8 Note that the 
Mission Level Control might also have beneath it a structure similar to that of the intelligent engine control 
hierarchy, corresponding to the airframe. The algorithms described in this paper support the levels below the Engine 
Level Coordinator in figure 3. 

Laboratory research has been carried out into the different components of an intelligent control system for jet 
engines over many years, mostly in simulation. Occasionally the results of the research are incorporated into a 
product that is used on-wing, but this is rare because of the need for a technology to “buy” its way on board, and a 
general reluctance to add complexity as it is perceived as reducing reliability. Thus the irony of intelligent control is 
demonstrated: increased functionality is obtained through the addition of complexity and thus at the expense of 
reliability — there must be a net gain in reliability brought about by the added complexity, and it is precisely this that 
has been the impediment to the serious development of an intelligent control system for jet engines. 

This will be changing, however. Because of new affordability goals for aircraft propulsion systems, many 
technologies including those related to intelligent control and health management will need to mature to the point 
where they can be used. The U.S. Federal Government is sponsoring a significant amount of the work in these areas 
with the majority of the research being driven by several government programs that advance various goals for 
commercial and military engines. The Versatile Affordable Advanced Turbine Engines (VAATE) program is a joint 
Department of Defense (DoD), NASA, Department of Energy (DOE), Industry effort focused on a 10x 
improvement in turbine engine affordability by the year 2017. The VAATE goals are 1) to maximize propulsion 
system affordability by reducing fuel consumption and improving durability and life, and by exploiting synergies 
between common military and civil cores; and 2) to apply revolutionary technologies to achieve quantum 
improvement in turbine engine capability and cost. In parallel with turbine engine capability increases, VAATE 
places major emphasis on Research and Development efforts to reduce turbine engine development, production, and 

• 9 10 

maintenance costs. ’ 

The VAATE plan includes many technology areas related to Controls and Engine Health Management. Utilization 
of integrated ground-based and on-board control, diagnostic, and prognostic systems will maximize engine time-on- 
wing. This will be achieved while minimizing support costs without compromising performance and survivability. It 
will provide flexible health management technologies that can be integrated into legacy, pipeline, and future 
propulsion systems. 

Additionally, NASA is interested in intelligent technologies to effect substantial reductions in emissions and noise 
generated by commercial aircraft, to improve the safety of commercial aircraft, and to increase the throughput of our 
air transportation system. Specifically, NASA goals are to achieve reductions in carbon dioxide emissions by 
20 percent, to achieve reductions in nitrogen oxides generated during take-off and landing by 70 percent, and to 
achieve community noise level reductions of 20 db of effective perceived noise. Safety and mobility goals are 
similarly aggressive, with metrics concerning: 1) reductions in the fatal accident rate, 2) reductions in the 
vulnerability of the air transportation system to hostile threats, 3) mitigation of the consequences of accidents and 
hostile acts, and 4) the enabling of more people and goods to travel faster and farther with fewer delays. These will 
be met by technology advancements in both airframe and propulsion systems, including advancements in both 
conventional and “intelligent” technologies. 

Many of the necessary intelligent control system technologies lend themselves to life cycle cost (LCC) reduction. 
Primary drivers for LCC are maintenance, reliability, and fuel consumption. Reduction of all three requires a smarter 
engine, one that will provide real-time, accurate diagnostic and life management status. To accomplish this, the 
system must be not only aware of but responsive to its condition (i.e., temperatures, efficiency, and performance). 

Many other technologies will be required as well to meet the goals: Micro-Electro-Mechanical Systems (MEMS), 
light weight high temperature materials, sensors for harsh environments, etc. Some of these technologies will open 
up opportunities for additional aspects of control, notably active control of components, 11,12 but it will suffice here 
simply to mention that fact, since we are focusing on algorithms that have minimal need for the development of new 
supporting technologies. 


Control 

New techniques have been developed that address specific issues within the current propulsion control paradigm, 
and modern approaches to old problems have been attempted in an effort to meet the goals of future engines. They 
are not all complementary; some techniques are appropriate for several applications, which can be a great benefit. In 
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the following subsections, various applications are presented and specific approaches discussed; these go beyond the 
current practice and are relevant technologies for the future intelligent engine. 

Life Extending Control 

Engine controllers are designed to meet certain operability and performance constraints. Some are engine-related, 
such as that the engine should not stall on acceleration; some are externally imposed, such as the Federal Aviation 
Administration’s (FAA) rise time requirement for thrust in commercial engines. The rise time requirement results in 
the development of an acceleration schedule (the maximum rotor speed rate-of-change loop as a function of rotor 
speed, sometimes called the Ndot control mode) that is designed simply to accelerate the fan and core to achieve 
desired thrust within the required time, while not exceeding other constraints. Durability is one of the key VAATE 
goals, so it is reasonable that it should be taken into consideration in the design process of future engine control 
algorithms. The idea of Life Extending Control is to design a control system which provides acceptable engine 
response while minimizing component damage. The concept of Life Extending Control has demonstrated that by 
using smart acceleration logic for engine control, the thermomechanical fatigue damage accumulated during a 
typical engine acceleration transient from idle to full power can be significantly decreased without any noticeable 
loss in engine performance. By slightly reducing the peak temperature during a transient, significant part life can be 
saved. A typical baseline acceleration schedule for a commercial turbofan engine, as well as schedules optimized to 
achieve acceptable take-off transients while minimizing life consumption for a specific hot section engine 
component, is shown in figure 4. The thrust transients that correspond to these schedules are shown in figure 5. 
Simulation results demonstrated that the optimized acceleration schedule decreased component life consumption 
during takeoff significantly for the same rise time, and extending the rise time slightly reduced the life consumption 
even more. 13 A recent study 14 looked at several potential component life extending technologies, and it showed that 
smart acceleration/deceleration logic was the highest ranked software-only technology while active clearance 
control was the highest ranked software/hardware technology. 15,16 One potential architecture that enables adjustment 
of the schedules in response to accumulated engine damage is shown in figure 6 (ref. 17). 



Normalized NH Speed 


Figure 4. — Baseline and optimized acceleration schedules 
for takeoff acceleration process. 
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Figure 5. — Thrust response curves for the nominal 
and optimized acceleration schedules. 
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Figure 6. — A Life Extending Control Architecture to adjust 
schedules in response to accumulated damage. 


Adaptive Control 

Generally, adaptive control involves the matching of a closed loop transfer function, and as the plant changes, due 
to variations in operating point for instance, the controller adjusts its gains to match an identified plant model. In 
current engines the Proportional-integral (PI) controller gains are scheduled on a parameter such as fan speed. This 
method assumes that the engine dynamics do not change significantly over time relative to the scheduling parameter, 
or that the controller is designed to be robust enough to accommodate the changes. Although the controller gains 
change with operating condition, there is some argument over whether this should be considered an adaptive 
technique since they are scheduled based on a measured or computed parameter in a predetermined way without any 
attempt at system identification. 18 
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An opportunity for adaptation within the current engine control framework concerns adjusting the schedules and 
limits within the controller. In current engine controls, a Proportional-Integral controller is used to maintain fan 
speed or engine pressure ratio about a steady state point. When the reference signal changes enough that the engine 
will no longer remain near steady state, acceleration or deceleration schedules or limits come into play, which 
determine the rate at which the engine will transition to its new operating point. These schedules are based on 
considerations such as stall and over temperature avoidance. Thus the response of the engine may be slowed down 
in order to stay within operability limits. There has been some promising preliminary work replacing the traditional 
limit logic with fuzzy limit logic, resulting in improved transient performance with potentially less fine-tuning of the 
controller. 19 

Additionally, no matter how the schedules and limit logic are implemented, it may be appropriate to override them 
in some emergencies. Obstacle avoidance, emergency egress, and compensation for damage 20 are all examples of 
situations where rapid acceleration might be critical to saving the vehicle. One solution to these problems involves 
developing reconfigurable schedules that allow the engine to operate beyond its normal boundaries for a short time, 
at the risk of component life, but with the benefit of potentially saving the vehicle and passengers. 21 

Multivariable Control 

Multivariable control moves beyond the classical transfer function approach, emphasizing the state space 
representation of the system model (sets of first order ordinary differential equations describing the behavior of a 
system). The state space formulation led to the development of theory in optimal control and robust stability, as well 
as comprehensive design procedures, and many other advances. This progress was prompted by the advent of the 
stored-program digital computer and, significantly, the requirements of the aerospace control problem. 22 Thus, the 
introduction of the electronic engine controller opened up a whole new application area for multivariable control, 
and consequently the state of (experimental) engine control has been greatly advanced. 

Over the last two decades, a great amount of research has been published related to multivariable control of jet 
engines. 23,24 Jet engines provide an excellent test bed for the various algorithms because they are complex, nonlinear 
systems with significant interaction between components. There is the opportunity to optimize performance of the 
whole system, or of individual components. A multivariable control exploits both the knowledge of the physical 
plant, such as the gas turbine, and the multiple inputs and outputs to the control system. This additional complexity 
can provide the control system designer additional techniques to optimize the plant performance. 25 

The Full Authority Digital Engine Controller (FADEC) enables the implementation of multivariable control 
schemes, as well as related technologies that they depend on, such as estimators of unmeasured state variables. 
However, these schemes rely on the existence of good models for the design process. Trade-offs may be made 
between model uncertainty and performance, and multivariable control schemes do not lend themselves to “tuning.” 

In order to achieve a successful multivariable control implementation, the control designer must first develop a 
robust, adequately descriptive model of the plant, derived from the inherent physics. Next, the control system must 
be designed with a properly nested loop structure which adequately considers the multiple input and output variables 
as well as their interactions. Finally it must be extensively validated and calibrated against experimental data, such 
as that collected on the engine test stand and in flight test. 

Multivariable control offers superior performance to traditional PI control. Multivariable control avoids the 
pitfall of multi-loop control, specifically the need to sub-optimize the control loops to avoid system instability due to 
the interaction of the separate control loops. Instead, multivariable controllers take into account loop interactions and 
their de-stabilizing effects, allowing the overall system to be optimized, 26 and augmentation with artificial 
intelligence (AI) techniques may produce even better performance. 27 Furthermore, the multivariable control provides 
“virtual measurement” of system parameters that are not directly measured but can nevertheless be used for 
monitoring or even control. This performance improvement must be evaluated against the increased complexity and 
up-front development time and cost in order to assess its net benefit to the aircraft propulsion capability. 

Performance Seeking Control 

Aircraft engine performance seeking control technology has been advanced under a number of DoD and NASA 
led programs. 28 " 31 The goal of performance seeking control is to operate the engine in a manner to achieve optimal 
performance based upon the current condition of the engine and the current mission of the aircraft. Optimal 
performance is typically defined in terms of fuel burn, thrust, engine life, or a combination of these objectives. 

A comparison between a conventional aircraft engine control architecture and a performance seeking control 
architecture is shown in figure 7. In both cases the engine control system is responsible for providing the desired 


NASA/TM— 2005-2 13622 


8 




Sensed 



Sensed 

Feedback 


_ Measurements 


Control Logic 


Actuator 

Commands 


• Actuator Commands Commands 


Signal Processing 
Control Updates 
Actuator Commands 
Adaptive Logic 


/ 


On-board 
Adaptive Model 


Model 

Estimated 

Parameters 


• Tracking Filter 

• Condition Estimation 


Conventional 
Control Architecture 


Performance Seeking 
Control Architecture 


Figure 7. — Comparison of conventional and Performance Seeking Control Architectures. 

level of thrust while maintaining the necessary operability margins at steady-state and transient operating conditions 
throughout the engine operating envelope. Since engine parameters such as thrust and stall margin are not directly 
measurable, the conventional control design approach is to infer these parameters through other direct sensor 
measurements such as rotor speeds and pressure ratios. Complicating this process is the fact that slight performance 
variations always exist between engines due to engine-to-engine manufacturing variations. Furthermore, each 
individual engine will naturally undergo degradation over its lifetime of use. To account for these variations the 
conventional control system must be designed to ensure robust operation for a range of engine conditions from fully 
healthy to fully degraded. However, this robustness is obtained in exchange for performance. Performance seeking 
control aims to address some of the shortcomings of conventional control logic by directly controlling the 
parameters of interest, and optimizing engine operation based upon the current condition of the engine. This is 
achieved by using a real-time on-board aerothermodynamic engine model incorporated into the engine control 
architecture as shown in figure 7. An associated on-line parameter estimation algorithm, or tracking filter, adjusts 
model tuner parameters to match the performance of the physical engine. Linear estimation techniques, such as 
Kalman filters, are often used to implement the tracking filters. Once the on-board model is accurately tuned it 
provides accurate estimates of sensed engine outputs as well as estimates of unmeasurable engine parameters such 
as stall margin and thrust which can be used for direct feedback control purposes. By adapting to account for engine 
variations and controlling directly on the parameters of interest, the engine control can be optimized to provide 
enhanced performance while still providing the necessary degree of robustness. 

In the past, performance seeking control technology has been evaluated in engine ground-based tests and flight 
test environments demonstrating the benefits of the technology. It should be noted that any model-based 
performance seeking control technology is only as accurate as its corresponding on-board model. Therefore any 
advances in on-board modeling or tracking filter technology will directly enhance the capabilities of such model- 
based control approaches. 32 Additional advances are required in terms of control logic verification, validation and 
certification. Any adaptive control technology must adequately address these issues to ultimately transition into 
service. The on-board model estimation and tracking technology is not unlike the estimation techniques used for 
ground-based performance diagnostics. In addition to the control functionality that it provides, an added benefit of 
having a real-time on-board performance model is that it supplies real-time continuous trending of engine 
component health and can be invaluable for fault detection and isolation purposes. 

Model Predictive Control 

Model Predictive Control (MPC) is unusual in that it is actually an open loop control scheme. The premise behind 
it is that an on-board model is running faster than real time, using simulated control inputs over a time horizon 
(fig. 8). The best simulated control input at the current time is then used as input to the real engine. This sequence is 
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Figure 8. — Model Predictive Control, prediction horizon and control horizon. 

repeated at each time step, computing and applying the best control input each time. Because it is always 
determining the optimal control by projecting out in time, the system is technically running open-loop, where the 
success of the control sequence depends on the accuracy of the model. Research implementations have used both a 
piecewise linear model 33 and a nonlinear Component Level Model (CLM) linearized at each time step 34 as the on- 
board model. 

One of the advantages of this technique is that the goals and constraints may be changed on line. An example of 
this is that the controller can minimize temperature increase during transient operation while minimizing specific 
fuel consumption during cruise. It is a complex, computationally intensive scheme, however, which requires a lot of 
on-board computing power to run a model many times faster than real time. Additionally, the model must be highly 
accurate, even at off-nominal conditions, for the MPC methodology to be successful. 

Diagnostics 

The objective of a diagnostic system on a turbofan engine is to avoid catastrophic failures, prevent costly damage 
to engine components, provide accurate fault detection and isolation to maintenance personnel, and reduce costs due 
to premature or past-due maintenance. 

Often, such intelligent systems architectures are simply an artifact of the capabilities of the underlying available 
tools. The opposite of this “invisible hand” design is an explicitly-designed architecture that guides the software 
system development. The high-level factors that affect the design are available technology (e.g., neural network or 
rule-based reasoning) and the target application. A flexible architecture will allow adaptation to new technologies, 
such as 64-bit processors, wireless sensor networks and newer compilers, while allowing optimizations of accuracy, 
speed, and cost of system health management. 

Health management involves the complete path from sensing the value of a particular measurement to the 
execution of a particular action that enables optimal performance. In general, techniques in classification, inference, 
projection, and decision making can be applied to areas such as diagnosis, prognosis, condition-based maintenance, 
and fleet management. Diagnosis can be performed using inductive learning such as decision trees, 35 case-based 
reasoning, rule-based or model-based approaches, 36,37 explanation-based learning, genetic algorithms for search and 
optimization, neural networks, fuzzy learning and soft computing techniques. 

For engine health management, the specific tasks may include a subset of fault detection, isolation, identification, 
prediction, explanation, remediation and simulation. Usually the most important fault characterizations are how they 
manifest, what causes them, and what they affect. 

Faults can be broadly categorized as follows: 

1) When they occur: during the initial phase, during the regular operation phase or end-of-mission phase 
(there is a usually bathtub curve for probability of fault occurrence versus time) 

2) How long they last: whether permanent, temporary, or intermittent 

3) How they manifest: whether discrete or continuous (e.g., leak), abrupt or gradual 

4) How they relate to other faults: whether independent, correlated, cascading, or simultaneous faults with a 
common cause 
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5) What causes them: inherent in design (structural or functional), due to uncertainties in operating envelope, 
or due to external conditions 

6) What they affect: the component, the subsystem or the system 

7) How critical are they: non-critical, recoverable or mission-critical 

Expected failure rates for many system components are usually outlined in a Failure Modes and Effects Analysis 
(FMEA). Other domain knowledge, required to build a model of the system, comes from schematics, block 
diagrams, instrumentation list (sensor type, location, number, redundancy, sampling rates), telemetry list and the 
operations timeline. There may also be information from fault analyses — fault trees, event trees, and probabilistic 
risk assessment. 

Software quality assurance is critical, especially if the controller action depends upon the results of the 
diagnostic system. The implemented software system for aircraft engine control will be a safety-critical, real-time 
system. It must satisfy explicit response time constraints. In addition, it must integrate with external software (such 
as diagnostic software from other subsystems) and share information with it. To implement such high performance 
diagnostic software, appropriate software engineering practices must be followed right from the beginning. This 
includes all phases such as requirements specification (for the controller and for the software), executable 
specifications, reliable coding practices and code generation, performance analysis, and verification and validation 
of the system. 

Engine malfunctions constitute a significant percentage of in-flight problems. While Engine Monitoring Systems 
(EMS) are routinely used, 38 the abundance and ambiguity of data, combined with simple, threshold-based triggers, 
results in a high percent of “nuisance” alarms that are costly to address. An additional challenge is the ability to 
record, store on-board, transmit to ground, store on ground, and interpret vast amounts of diverse data, and the 
ability to distill relevant information and useful knowledge. On-board monitoring isn’t an end goal, but an essential 
step in diagnosis, prognosis or intelligent control. The rest of this section discusses various aspects of engine system 
and component diagnostics that are currently under development. 


Gas Path Performance Diagnostics 


Gas path performance diagnostics involves estimating the values of specific variables associated with the gas path 
components, or changes in these values that might indicate a fault. It is important to distinguish between the general 
health of the engine gas path components and sudden faults. The general health of the engine is equivalent to its 
level of degradation or effective age, and is the baseline from which changes are measured. In the gas path, the 
health condition of each component is defined by its efficiency and other parameters that change slowly. In general 
there are not enough engine sensors available to allow estimation of these health parameters in flight. Some 
diagnostic schemes relate faults to abrupt changes in the parameters associated with component health. Thus, on-line 
monitoring of unmeasurable variables is the basis for many fault detection and isolation approaches. 39 The 
information flow diagram in figure 9 indicates how damage and wear is related to degraded performance. 40 Many 
linear and nonlinear techniques have been applied to this problem, but without the addition of diagnostic sensors, the 
problem will remain. The estimation problem arises because the number of health parameters exceeds the number of 
measurements, which means that the problem is underdetermined and thus the health parameter shifts can not be 
uniquely determined. 41 The problem is further complicated by estimation errors due to model mismatch, noise and 
sensor bias. The sensor validation issue is addressed in the section on Control System Integrity Assurance. 
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Figure 9. — Diagram indicating information flow for turbine engine gas path diagnostics. 
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Vibration Diagnostics 

In all but some specialized cases, vibration diagnostics are used for trending of structural health. Increases in 
vibration amplitude over time might indicate a change in rotor balance related to, for instance, a damaged fan blade 
or a bearing failure. The low sample rate of the measurement essentially precludes its use as a real-time diagnostic 
tool, but many possibilities will be opened up when high frequency measurements become available along with on- 
board signal processing. Sensors with higher frequency capability combined with more sophisticated processing can 
detect more subtle degradation of bearings, gearing, accessories and structural components. The cost of this 
enhancement is not negligible, notably in the signal processing and communication and display of the resultant 
information, but the main hurdle is the testing and ongoing analysis necessary to define the relevant signatures, and 
incorporate them, as failure modes surface. 

Lubrication System Diagnostics 

Diagnostics for lubrication systems focus on such things as contaminants in the oil. This gives an indication of 
wear to internal parts as well as damage progression, and since the metal chips that the sensors observe are from 
individual parts, it may be able to isolate the damage location as well. 

Some work has been done in fusing vibration and lubrication system diagnostics to achieve a higher level of 
confidence in the detection of part wear, and it will lead to improvements in the development of future health 

42 

monitoring systems. 


Control System Integrity Assurance 

A large component of propulsion diagnostics is the critical function of control system fault detection and isolation. 
Some of this is based on basic control system sensors, and primarily position feedbacks (continuous and switch 
position). With the advent of FADEC’s, dedicated self-test circuitry is required to ensure the integrity of the control 
system itself while providing necessary levels of fault isolation to line replaceable units (LRUs). 

While implementation has improved over the past two decades, poor control system diagnostics and fault isolation 
continue to bedevil flight operations with unacceptable “no fault found” control component removals. Selectively 
applying the methods being developed for engine health management, including a systems engineering approach, 
dedicated sensors and prognostics to control system integrity may be cost effective. Complex fuel pumps, fuel 
metering units, actuators, electrical power systems and oil system components can be monitored for performance 
degradation by using existing or added sensors to sense and trend temperature, differential pressure, slew rates, 
valve position, etc. Blade tip clearance sensors being considered for active control have the potential to detect and 
isolate a major cause of performance degradation. Microwave and optical sensors proposed for tip clearance 
measurement can provide high frequency tip timing data permitting detection of deflection and vibration of 
individual blades, and isolation of blade damage. The signal and data processing burdens are disincentives that may 
be overcome by the benefits to specific engines. 

A specialized and well-developed area of control system integrity assurance is sensor validation (fig. 10). Sensor 
validation schemes tend to be model-based in that the residuals (the differences between sensor measurements and 
model- synthesized estimates) are checked, and a large residual indicates that a fault has occurred. The engine model 
can be built in various ways that directly relate to the validation scheme to be used. For instance, least-squares-type 
parameter estimation schemes can provide estimates of sensor gain and bias faults by incorporating these parameters 
into the plant model. 43 

Another method of sensor validation relies on a bank of Kalman filters (fig. II). 44,45 A Kalman filter takes in 
sensor readings and produces state variable estimates that are used with a built-in plant model to generate sensor 
estimates. The bank of Kalman filters consists of multiple filters, each of which utilizes a different sensor suite. The 
first filter uses all but the first sensor as input, the second filter uses all but the second sensor as input, and so on. 
Thus, each filter tests the hypothesis that the sensor it does not include is faulty. When a sensor fault occurs, the 
output of all filters but one will be corrupted by the faulty information. Therefore, the fault causes the residuals 
associated with all filters but the one that does not use the bad information to grow large, revealing the defective 
sensor. 

This method has been extended from sensor fault detection and isolation to include actuator and component fault 
detection as well. 46 This is accomplished by adding an additional Kalman filter that utilizes all sensors, and 
estimates several tuning parameters in addition to the state variables to account for model mismatch due to 
component or actuator faults. If the tuning parameter estimates become large while the residuals in the sensor fault 
hypothesis filters remain small, it indicates that the fault is probably in a component or actuator. 
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Figure 10. — Generic sensor validation scheme. 
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Figure 11. — Bank of Kalman filters sensor validation scheme, estimates are 
compared to measured outputs and residuals are used to declare a fault. 
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Figure 12. — Artificial neural network sensor validation scheme; network recreates 
outputs from measurements, even if a measurement is corrupted. 
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Yet another method for performing sensor validation, using an artificial neural network (ANN), was demonstrated 
in simulation in NASA’s High Reliability Engine Control program, 47 and was subsequently applied to a helicopter 
turboshaft engine as well (fig. 12). 48 The ANN consists of an input and output layer with the number of nodes equal 
to the number of sensors. There are three hidden layers: mapping, bottleneck, and demapping. The mapping and 
demapping layers are both large compared to the input and output layers. The bottleneck layer is small, and is 
trained to represent only the essential information contained in the system outputs. This ANN formulation can be 
robust enough to reproduce accurate sensor estimates (outputs) even with a faulty input. Sensor outputs are fed into 
the input layer of the ANN and compared to its output. If they are similar the sensors are considered to be operating 
properly. If an input and output diverge, the sensor is declared faulty and the ANN’s estimate can be used to replace 
the bad sensor, thus providing sensor fault isolation and accommodation. 

Diagnostic sensors 

In general, the sensors on which propulsion diagnostics are founded are the engine sensors that were in place 
before the advent of electronic controls. These include fuel flow meters, oil system chip detectors, oil level 
indicators and pressure switches, vibration pickups, temperature, pressure, and rotor speed measurements. These 
items are diagnostic to some extent, and regulatory mandates and established procedures have “grandfathered” them. 
The criticality of these sensors to mission readiness and performance ensures that they are robust and well 
maintained. 

Most deployed engine health management systems depend primarily on this core sensor set, and have 
demonstrated significant diagnostic capability. The cost effectiveness and suitability of additional dedicated 
diagnostic sensors will continue to be challenged, and each such sensor must show strong promise to counter the risk 
that the costs and added operational complexity will outweigh any practical gain. The severe thermal and vibration 
environment on the gas turbine, combined with the volume, weight and design limitations imposed by integration 
into a gas turbine, make this more difficult. The low production volumes of unique diagnostic sensors compound the 
problem. 

Note that the cost of monitoring an additional engine parameter is not limited to the sensor itself. The cost of 
additional harness wires, connector pins, dedicated driver and signal acquisition hardware, analog to digital 
conversion, and software and computational burden outweigh the recurring cost of the sensor. For high bandwidth 
sensors (higher frequency vibration, dynamic pressure, blade tip timing, optical and microwave sensing etc.), or 
other sensors applications requiring sophisticated real time processing for feature extraction (e.g., electrostatic gas 
path and oil debris), the electronic hardware and (often dedicated) computational burden far outweigh other 
considerations. 

The challenge for proactive engine health management is the development of diverse sensor suites with common 
interfaces to standardized electronic signal acquisition hardware, and flexible hardware and object oriented software 
architectures facilitating rapid, economic modification of the diagnostic sensor kit to address unanticipated failure 
modes and operational conditions. 

Multiplexed sensor interfaces, so one standard I/O channel can serve multiple sensors, is established practice in 
industrial sensor applications. However, “smart sensors” equipped for data bus communication perpetuate dedicated 
signal processing electronics in adverse environments that increase costs by an order of magnitude. Advances in 
high temperature electronics or “passive” sensor multiplexing may make this avenue more promising for gas turbine 
applications. 

The classes of dedicated sensors currently being employed or advanced for engine monitoring and diagnostics are, 
in rough order of priority or viability: 

1) Component aero-thermodynamic performance 

2) Oil borne debris and oil contamination/degradation 

3) High frequency vibration 

4) Gas path debris and foreign object ingestion/damage 

5) Turbomachinery (clearances, blade and disk) integrity/degradation 

6) Other (secondary air/oil scavenge systems, etc.) 

Data/Information Fusion 

The value of individual sensors may become less intrinsic and more dependent on synergies gained from data 
fusion across diverse sensors as more sophisticated diagnostic and engine health management techniques gain 
acceptance, particularly in compensating for the unacceptably high false positive rates of many sensors and 
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algorithms. A wealth of aircraft turbine engine data is available from a variety of sources including on-board sensor 
measurements, operating histories, and component models. Furthermore, additional data will become available as 
advanced prognostic sensors are incorporated into next generation gas turbine engine systems. The challenge is how 
to maximize the meaningful information extracted from these disparate data sources to obtain enhanced diagnostic 
and prognostic information regarding the health and condition of the engine. One approach to addressing this 
challenge is through the application of data fusion techniques. Data Fusion is the integration of data or information 
from multiple sources, to achieve improved accuracy and more specific inferences than can be obtained from the use 
of a single source alone. It draws from a wide range of technology areas including artificial intelligence, pattern 
recognition, statistical estimation, and fuzzy logic. The basic tenet underlying the data/information fusion concept is 
to leverage all available information to enhance diagnostic visibility, increase diagnostic reliability and reduce the 
number of diagnostic false alarms. Under a NASA-funded effort, data fusion techniques are being applied for 
aircraft gas turbine engine health management purposes. 49 This effort is closely aligned with the ongoing C-17 
Propulsion Health Management Flight Test Program led by NASA Dry den and is being applied to the Pratt & 
Whitney FI 17 engine which powers the C-17 aircraft. An overview of the Data Fusion architecture developed under 
this activity is shown in figure 13. 

It is a hierarchical architecture, which monitors engine sensor information, performs signal processing, data 
analysis and health assessment, and provides maintenance action recommendations to the end user. It is also an open 
and modular architecture which allows additional sensor information and diagnostic modules to be added as they 
become available. In figure 13 a variety of information sources can be seen including sensor measurements, FADEC 
fault codes, maintenance and pilot observations, and engine maintenance history information. While these 
information sources are rich in content, they exist in vastly different formats and sample rates. For example 
advanced vibration sensor measurements may be sampled in the 10’s of kilohertz range whereas gas path 
measurements may be sampled in the 10’s of hertz range. Due to the disparate sample rates among system 
measurements, a necessary function to be performed prior to subsequent fusion is data alignment, which time 



Figure 13. — Health Management Data Fusion Architecture (adapted from ref. 49). 
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synchronizes all system information to a common sampling rate. This is accomplished by up and down sampling the 
raw information. Converting the information to a common time frame helps support the distinction between 
correlated and non-correlated system events. The point in the process at which data alignment is performed on the 
information is significant, particularly for any high frequency measurements as the user wants to avoid the loss of 
any critical health information contained within the raw data. As shown in figure 13, data analysis and feature 
extraction of the high frequency sensor measurements occurs prior to data alignment. The analysis modules perform 
signal processing and feature extraction. Example modules are vibration analysis, lubrication system monitoring, gas 
path performance monitoring, and fault codes generated by the FADEC. After data alignment and health feature 
extraction has been performed the information is provided to the information fusion module. The principle objective 
of the information fusion module is to convert multiple sources of information into a unified engine health 
assessment. This process requires a fundamental understanding of engine malfunctions, as well as a methodology for 
inserting evidence to support (or refute) a specific root cause of a malfunction. 

There are a variety of information fusion techniques that can be applied. 50 Stochastic data fusion approaches, such 
as a Bayesian Belief Network (BBN), provide a confidence level in the existence of a particular fault. 51 This can be 
useful in setting detection thresholds to obtain acceptable performance in terms of false alarms and missed 
detections. Stochastic data fusion approaches do however require a priori conditional probabilities for fault 
occurrence, fault detection, and fault missed detections to be specified. For aircraft gas turbine engine health 
management applications precise conditional probability information is often unavailable. Also, as the number of 
fault types and the number of fused diagnostic modules grows, the required number of conditional probabilities that 
must be specified grows exponentially. An alternate fusion approach is the Fuzzy Belief Network (FBN). 49,52,53 
FBN’s use fuzzy belief functions to assign confidence levels in lieu of exact conditional probabilities. They are also 
more computationally tractable than BBN’s. FBN’s do require expert knowledge to generate the parametric inter- 
relationships and assign fuzzy levels of confidence. The final step in the above information fusion architecture is the 
fault isolation reasoner module which processes the engine health assessment information along with past 
maintenance and pilot observations, and makes recommended maintenance actions. It consists primarily of a Failure 
Modes Effects and Criticality Analysis (FMECA) model of the engine along with a line maintainers’ Fault Isolation 
Manual (FIM) procedure. 49 

Applying information fusion techniques to the aircraft gas turbine engine health management application does 
hold much promise. Areas for future enabling work include instituting the necessary process to collect and maintain 
a suitable aircraft engine fault database. Such a fault database would be critical for providing the necessary 
conditional probability information required by stochastic data fusion techniques. Another requirement for an 
effective information fusion architecture is to have a rich source of information and diagnostic methods. Orthogonal 
information and diagnostic methods are ideal, as they will be complimentary in corroborating or refuting a broad 
range of fault scenarios. On the other hand, the fusion of information and/or methods that are either highly 
correlated or uncorrelated in their fault coverage will provide little benefit versus using the diagnostic techniques 
independently. Thus effective system studies need to be performed to include within the fusion architecture the 
correct combination of sensors and algorithms to address the faults of interest. 

Prognostics 

The term prognostics, when applied to turbine engine components, generally refers to an estimate of the 
remaining useful or safe life. Specific components such as turbine disks have a mandated life in terms of take-off 
and landing cycles after which they must be removed from service. This safe life is determined through, among 
other things, material testing, spin testing, and finite element analysis. A life distribution is obtained based on some 
assumptions about operating conditions and the safe life limit is defined in terms of probability of failure (fig. 14). 
Because of the expected spread in the time-to-failure distribution, it turns out that most disks are removed with over 
90 percent of their useful life remaining. The monetary wastefulness of this retirement for time approach has 
prompted work in the area of retirement for cause , in which life-limited parts are removed based on inspection 
findings rather than cycle count alone. Even though this approach is more cost effective, without an on-line crack 
detection system it is time consuming and labor-intensive. Vibration, acoustic, tip timing and direct in situ sensors 
are being evaluated as a means to this end. Extreme dependability requirements in a difficult environment make this 
a challenging task. 
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Cumulative Life Damage, 1=5,000 flights 

Figure 14. — Weibull distribution for probability of failure. 

Other engine components such as turbine blades are replaced as a result of inspection findings. Since these parts 
are allowed to “fail” (defined not necessarily by breakage but by visible damage accumulation), it is possible to 
develop models that relate usage to life consumption and validate them on in-service parts. New sensor-based 
methods combined with physics of failure models are being developed that relate ambient conditions 54 as well as 
internal engine conditions to life usage. 55 These software enabled approaches relate measurements taken on-line to 
life consumption and thus give a much better estimate of the true remaining life, supporting the notion of condition- 
based maintenance and allowing the convenient scheduling of maintenance, which may greatly simplify the 
logistical problems of part availability. 


Integration 

Up to this point, individual approaches and algorithms have been presented. With the exception of the data fusion 
system presented previously, these are stand-alone algorithms, and while some of them individually might be 
considered intelligent, their implementation on a complex system like an engine does not make the overall system 
intelligent. The intelligence comes from their integration in such a way that they interact to raise the level of 
autonomy of the system, as in figure 3. This relates to real-time operation of course, but to achieve future cost and 
performance goals, it extends to maintenance and logistics, and it requires that information not be lost as parts are 
swapped or equipment upgraded. This implies that the engine has self-knowledge about its components and usage, 
i.e., on-board knowledge should be retained, even after an overhaul has been performed. 

Integrated Fault Detection, Isolation, and Accommodation Logic 

The ultimate goal of an aircraft engine health management system is to accurately and reliably detect faults prior 
to their escalation into more serious events. While this is a noble goal, there will always be cases where early fault 
prediction will not be possible, and in-flight faults occur. Some of those faults can be mitigated through real-time 
integrated fault detection, isolation, and accommodation (FDIA) logic embedded within the electronic engine 
controller. It is common for today’s aircraft gas turbine engines equipped with electronic engine controls to have 
some level of FDIA capabilities. For example limit checks, rate-of-change checks, and simple analytical checks are 
performed to validate sensor measurements. Typically engines are instrumented with physically redundant control 
feedback sensors. If a faulty sensor is detected the accommodation logic will revert to the physically redundant 
backup sensor. Likewise dual redundant FADEC channels exist. If a failure in the primary FADEC unit is detected, 
the system reverts to the backup channel. The control software also has secondary control modes to aid in fault 
accommodation. Upon the detection of specific faults, the engine control logic may have the capability to revert 
from its primary control mode to a secondary control mode to allow the engine to keep operating albeit perhaps with 
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reduced performance. The introduction of electronic engine controls has made such automated fault diagnostics and 
accommodation capabilities possible, and has helped to significantly improve the reliability and safety of aircraft 
propulsion systems. 

The future vision is to continue to enhance the automated FDIA capabilities of aircraft engines. 56 This includes 
improving sensor and actuator FDIA capabilities and expanding FDIA coverage to include component faults as well. 
The use of real-time on-board adaptive model technology described in the Performance Seeking Control section of 
this paper can be beneficial for fault diagnostic purposes. Such an approach can assist in the early and reliable 
diagnosis of system performance-related faults by providing an added level of analytical redundancy. While 
automated FDIA capabilities hold much promise, it should be emphasized that they are not a panacea for dealing 
with all in-flight propulsion malfunction scenarios. Multi-engine aircraft are designed to be able to safely operate 
with an engine out. There will be some engine faults that simply can not be accommodated in-flight, and in those 
cases the right decision is often for the pilot to shut down the faulty engine. Attempting to continue to operate a 
faulty engine may in fact incur additional damage which can lead to the need for costly repairs, or worse yet 
compromise vehicle safety. Another caveat regarding automatic reconfigurable controls is the need to ensure that 
they do not mask important sensory cues that pilots rely on to assist them in diagnosing faults. Furthermore, steps 
must be taken to ensure that automatic reconfigurable controls are not invoked erroneously, and that they do not 
exacerbate existing faults. Suitable verification, validation, and certification techniques will be crucial in ensuring 
that FDIA techniques are not prone to these pitfalls. 

MPC for Integrated Control and Diagnostics 

MPC lends itself directly to integrated control and diagnostics as long as the model is capable of capturing the 
effect of the fault. Thus MPC in the presence of a fault is no different than in the unfaulted case, because the 
simulation over the time horizon accounts for the fault, and still selects the optimal control accounting for it. For 
example, given that an actuator is stuck, the faulty system may be treated as a “new” system, where the effect of the 
stuck actuator may be an exogenous input, and the control system will have one fewer actuator to work with; this 
might also be handled as a new constraint on an existing actuator’s movement. This generalization of the 
reconfiguration problem makes MPC ideal for switching in real time between various plant models representing 
baseline and damaged engines, accommodating faults naturally within the framework of the problem statement. 

Engine Health Management, Support Engineering, Maintenance and Logistics Integration 

Automated engine health management has the potential to significantly reduce maintenance effort and propulsion 
systems’ logistical footprint. More detailed data on equipment reliability and failures is also crucial for support 
engineering to prioritize and resolve problems in the field - both with equipment design and with operations and 
maintenance procedures and tooling. 

The industry is attempting to redefine and automate equipment servicing, with an emphasis on AI and logistics 
techniques to minimize the human factor. As usual, incomplete process mapping and integration of the change effort 
across all process steps and players is the major impediment to defining and implementing effective process 
improvement. The Joint Strike Fighter program is a leading proponent within the DoD, but there are many other 
initiatives attempting to integrate support processes across all weapons platforms. In the civil world, lease and 
maintenance contracts have motivated the engine companies to evolve in the same direction. 

Information Technology (IT) structures and data management must be robust and support flexible distributed data 
processing, analysis and decision-making. Ideally, from the front line maintainer to the technician repairing a 
subcomponent of a subsystem, all players should have ready access to the information needed to plan and execute 
their task easily and intelligently. 

One approach to this challenge is the U.S. Army’s Automatic Identification Technology (AIT) initiative. 57 This 
approach equips all LRU’s with embedded memory (often passive non-volatile memory (NVM) modules bonded to 
the item but accessible with a laptop equipped with a read/write wand) that contains a current record of the LRU’s 
configuration, identity, usage and maintenance status, synchronized with the central maintenance database. 
(Similarly, the Pratt & Whitney PW200 turboshaft engine has a NVM module fixed to the engine, as the engine 
often gets separated from its FADEC when removed from the aircraft for repair.) Line and organizational 
maintainers can access and update the information, which is also readily accessible by the repair depot on receipt of 
a failed LRU. This parallel data structure, physically tied to the affected hardware, provides a redundant 
communication channel that adds robustness to the support processes. 

For example, critical LRUs often arrive at the repair depot with little or no information after passing through the 
logistics chain. With AIT, the LRU will carry critical data in embedded NVM identifying: reason for removal, 
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relevant FADEC fault codes, line maintenance comments, engine serial number and configuration, airplane tail 
number, and interfacing LRU identity and configuration data; even critical environmental, usage and performance 
trend information can be made available. If the LRU NVM is wired to the FADEC, this data can be automatically 
loaded into and from the FADEC. 

Such data can speed initial processing, determine whether an as-received test is required and guide 
troubleshooting. If the failure mode repeats, the AIT data can provide the original equipment manufacturer (OEM) 
support engineering valuable leads to understanding the circumstances and cause, and facilitating proactive 
identification of design or documentation improvements. When the unit is returned, the AIT NVM can be updated to 
identify repairs, parts replaced, etc. for operator reference and analysis when returned. 

Embedded NVM can offer benefits beyond engine health management. The OEM can load sensor calibrations 
and/or effector parameters into a control accessory NVM, which can effectively increase accuracy and/or reduce 
manufacturing cost, because the FADEC can read the NVM data to adjust sensor readings or nominal effector 
characteristics. Manufacturing tolerances can be opened up and/or more precise control made possible. 

Final Comments 

This paper presents a survey of selected research into Propulsion Control and Health Management technologies. 
These technologies have the potential to play a large role for future intelligent engines in the context of VAATE and 
NASA goals. Issues specifically related to future engines in terms of software enabled on-board technology are 
presented. By omitting technologies that require the addition of fundamentally new sensors or the development of 
other enabling technology, the conscious decision was made to leave out an area that that is considered to have a 
very high pay-off for future engines: active control. There is no doubt that advances in many areas will need to be 
made in order to achieve the goals, but technology exists today that can start to address them. This technology needs 
to be evaluated in light of what it can deliver, and that begins by addressing the reliability/complexity issue. 

Intelligent control and health management is going to be possible with software and more powerful FADECs. 
However, as systems get more complex the software will also tend to become more intricate. Thus it is imperative 
that the software be designed and implemented simultaneously with the engine development, that the software 
address the detailed requirements for the engine performance and safety, and that the software be tested both 
empirically and using more formal methods for verification. The potential contribution of technologies to overall 
VAATE and NASA goals needs to be quantified, and the integration of technologies needs to be investigated and 
coordinated in order to achieve the highest level of contribution to future engines. The goals will not be reached 
through algorithms alone, but the share that they can contribute can be met with further development in these areas. 
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